How to Set Up PGP Email Encryption in Thunderbird

Encrypted email has a reputation problem. Almost everyone agrees it matters, and almost nobody sets it up. The good news is that Thunderbird ships with OpenPGP built in these days, so the whole job — creating a key, swapping public keys with a correspondent, sending mail only they can read — happens inside your mail client. No plugin, no command line, no terminal window full of hex. Set aside half an hour and you will have working end-to-end encryption before you finish your coffee.

Before you start

You need Thunderbird 78 or newer; if your copy is older, update it first, because OpenPGP support arrived in that release and the old Enigmail add-on is no longer the way to do this. Any standard IMAP or POP account works, including Gmail, Fastmail, and self-hosted mail. You will also want the email address you intend to encrypt with, decided in advance — the address on your key must match the address you send from, or Thunderbird will refuse to use it.

One decision worth making now: whether to set a Primary Password. Thunderbird protects your secret key material through your profile, and a Primary Password (Settings, then Privacy & Security, then Passwords) adds an unlock prompt on top of it. On a shared or portable laptop, turn it on. If you lose the password, you lose access to the key, so store it somewhere sensible rather than only in your head.

Generate your keypair

Open Account Settings, choose your account, and click End-to-End Encryption in the left column. You will see a key list that is probably empty. Click Add Key.

1. Enter the name you want recipients to see, and the email address exactly as it appears in your account settings.
2. Leave the key type as RSA. A size of 3072 or 4096 bits is a reasonable default; larger works too, at a small cost in signing speed.
3. Set an expiry date. Two or three years is common practice, and it is not a trap: you can extend the expiry later or generate a fresh key when it lapses.
4. Give the key a passphrase, or rely on your Primary Password if you set one. Either way, the key is protected at rest.
5. Click Generate Key. Nothing else is required from you.

Thunderbird creates the key in a few seconds and shows you a fingerprint — a long string of characters in groups. Write it down or copy it somewhere you can find it. That fingerprint is how other people confirm they have the real key and not a forgery.

Back up the key, keep the revocation certificate

This step gets skipped, and it is the one people regret. Your private key lives in your Thunderbird profile. If the profile is deleted, the disk dies, or you reinstall your operating system carelessly, every encrypted message you have ever received becomes unreadable — permanently. There is no recovery service.

Open Tools, then OpenPGP Key Manager, select your key, and export the secret key to a file. Put that file on an encrypted USB stick or in offline storage. Then export the revocation certificate as well. If your key is ever compromised or you lose the private half, you publish the revocation certificate to tell the world to stop using that key. Keep the two files apart: a revocation certificate sitting next to a stolen private key is not much use.

Exchange public keys

Encryption needs two keys: yours to decrypt your own copies and sign, theirs to encrypt what you send. Getting your public key to the other person is on you, and there are three common routes.

• Publish to a keyserver. In the Key Manager, right-click your key and publish it. Thunderbird uses keys.openpgp.org by default, which verifies your address by email before listing the key. Convenient, but remember that a published key is public forever.
• Attach it to a message. In the compose window, the OpenPGP menu has an option to attach your public key. Most people find this the easiest route, since the recipient already has your message in front of them.
• Hand it over directly. Export the public key as a file and send it however you like — or better, paste the fingerprint into a chat message and read it aloud on a call.

That last point matters more than any button in the interface. A key that arrives by email could, in theory, have been swapped in transit. A fingerprint confirmed over a second channel — a phone call, a Signal message, five minutes in person — is what turns an encrypted conversation into a verified one. Do it for the people you correspond with regularly.

Send an encrypted message

Import their key first. In the Key Manager, use File, then Import Keys from File, Clipboard, or URL, or search a keyserver by email address. Thunderbird will ask whether you accept this key for that address. Accept it only after you have checked the fingerprint.

Now compose as usual. You will notice a key icon in the compose toolbar, near the right-hand side. Click it and choose to Encrypt and, usually, Sign. Signing proves the message came from you; encrypting hides the contents. In practice you want both.

A few things worth knowing before you hit send:

• The subject line is not encrypted. It travels in plain text, so keep it neutral — "Thursday" rather than the name of the contract you are discussing.
• Attachments are encrypted along with the body. There is nothing extra to switch on.
• If one recipient has no key, Thunderbird will offer to send unencrypted or cancel. Cancel, and sort out their key first. A half-encrypted message is a false sense of security.
• Blind carbon copy recipients still need their own keys. Hiding an address from other recipients does not hide the content from anyone.

Once you are comfortable, set encryption as the default for that account under End-to-End Encryption settings. Thunderbird will then encrypt whenever it can and warn you when it cannot.

When something goes wrong

Thunderbird shows a key icon in the message header when you open encrypted mail. A valid signature gets a positive indicator; a bad or missing one gets an alert. If you see "missing key", the sender's public key simply is not in your keyring — import it and reopen the message. If you see a warning that a signature is invalid, stop and check with the sender by another channel before trusting the content.

Expired and revoked keys produce their own prompts. Ask the other person to send you a current public key rather than overriding the warning. And if you switch the From address on an outgoing message, expect a complaint: each identity needs its own key.

Everyday habits that keep it working

Encryption is only as good as the routine around it. Add the people you write to often, verify their fingerprints once, and set encryption as the default so you stop thinking about it. Keep the exports of your secret key and revocation certificate somewhere that is not the machine you mail from. Check your key's expiry date once a year, the way you would check a passport. And accept that some mail — mailing lists, newsletters, the colleague who insists on a plain reply — will never be encrypted, which is fine as long as you know which is which before you type a password into a message body.

Photo: cottonbro studio / Pexels